 
 (defn update
   [{params :params}]
-  (let [result (commodities/update (env :db)
-                                   (select-keys
-                                     params
-                                     [:id :name :symbol :exchange :type]))]
+  (let [commodity (-> (commodities/find-by-id (env :db) (:id params))
+                      (authorize :update)
+                      (merge (select-keys params [:id
+                                                  :name
+                                                  :symbol
+                                                  :exchange
+                                                  :type])))
+        result (commodities/update (env :db) commodity)]
     (if (validation/has-error? result)
       (edit {} result)
       (redirect (format "/entities/%s/commodities" (:entity-id result))))))
 
 (defn delete
   [{params :params}]
-  (let [commodity (commodities/find-by-id (env :db) (:id params))]
+  (let [commodity (authorize (commodities/find-by-id (env :db) (:id params)) :delete)]
     (commodities/delete (env :db) (:id commodity))
     (redirect (format "/entities/%s/commodities" (:entity-id commodity)))))

(defn index
  [{params :params}]
  (let [entity (:entity params)
        commodities (commodities/select-by-entity-id (env :db) (:id entity))]
    (with-layout "Commodities" {:entity entity}
      [:div.row
       [:div.col-md-6

            [clojure.tools.logging :as log]
            [clj-money.util :refer [format-number]]
            [clj-money.web.shared :refer :all]
            [clj-money.authorization :refer [apply-scope
                                             authorize
                                             tag-resource]]
            [clj-money.models.auth-helpers :refer [user-owns-entity?
                                                   user-entity-ids]]
            [clj-money.validation :as validation]
            [clj-money.models.commodities :as commodities]
            [clj-money.models.prices :as prices]))
